Security audit

Meeting Prep Agent

Security checks for vulnerabilities and agentic risk

Overview

This meeting-prep skill needs review before installation because its automation is under-scoped, uses unfinished mock behavior, can erase its own history, and can display arbitrary local files when invoked with a path.

Install only after reviewing the scripts. Do not enable the suggested cron job or unattended auto-prep until mock behavior is removed, history updates preserve existing data, brief.sh is restricted to the briefs directory, and files are created with private permissions. Expect generated briefs to store meeting and attendee research locally.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/brief.sh:10
Finding: Unrestricted Local File Disclosure Through Brief Path Argument
Content: View full analysis
/dev/null; then glow "$BRIEF_PATH" else cat "$BRIEF_PATH" fi ;; --format\ text) sed 's/### /## /g; s/## /# /g; s/# /== /g; s/\*//g' "$BRIEF_PATH" ;; --format\ telegram) cat "$BRIEF_PATH" ;; *) echo "Unknown format: $FORMAT" cat "$BRIEF_PATH" ;; esac ``` ### Technical Analysis The script treats any caller-controlled argument that resolves to an existing regular file as a valid briefing document. It does not canonicalize the path, enforce containment within `BRIEFS_DIR`, reject symbolic links, or require the caller to use a meeting identifier. The selected file is subsequently passed to `cat`, `sed`, or `glow`. Consequently, the script acts as a general-purpose local file reader rather than a utility limited to generated meeting briefs. The issue crosses the intended access boundary of the Skill, although it does not grant access beyond the operating-system permissions already held by the process. ### Attack Path 1. An attacker causes an Agent ...[truncated 1097 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/auto-prep.sh:78
Finding: Automatic Preparation Overwrites and Deletes Persistent Brief History
Content: View full analysis
"$HISTORY_FILE" ``` ```bash log "Auto-prep cycle finished. Processed $PROCESSED_COUNT events, prepped $PREPPED_COUNT new meetings." # Clean up mock history file # In a real run, you wouldn't do this [ -f "$HISTORY_FILE" ] && rm "$HISTORY_FILE" echo '{"events":{}}' > "$HISTORY_FILE" ``` ### Technical Analysis `HISTORY_FILE` points to the production file at: ```bash HISTORY_FILE="$PREP_DIR/brief-history.json" ``` During every automatic execution, the script replaces that file with hard-coded mock history. At the end of the cycle, it removes the file and recreates it with an empty event map. The comments acknowledge that this is mock behavior, but there is no test-mode guard or separate fixture path. The destructive commands therefore execute during normal use, including the cron execution recommended in `SKILL.md`. This defeats the deduplication mechanism used to determine whether an event has already been prepared. It also destroys legitimate event-to-brief mappings written by `prep.sh`. ### Attack Path 1. The user follows the documented recommendation and schedules `auto-prep.sh` through cron. 2. A legitimate `brief-history.json` contains mappings for previously prepared events. 3. The scheduled script overwrites the file with a single hard-coded mock mapping. 4. The script performs its mock processing. 5. At completion, it deletes the history file and recreates it as: ```json {"events":{}} ``` 6. Future executions no longer recognize previously prepared events. 7. Events may be processed repeatedly, and duplicate brief generation or duplicate delivery may occur if message sending is later implemented. No malicious input is ...[truncated 849 chars]
Remediation: View remediation
"$HISTORY_FILE" fi ``` Production execution should fetch real events or fail safely without modifying persistent history. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/setup.sh:14
Finding: Sensitive Meeting Data Is Created Without Enforced Restrictive Permissions
Content: View full analysis
"$PREP_DIR/brief-history.json" echo "✓ Created brief-history.json" else echo "• brief-history.json already exists (skipped)" fi if [ ! -f "$PREP_DIR/prep-log.json" ]; then echo '{"preps":[]}' > "$PREP_DIR/prep-log.json" echo "✓ Created prep-log.json" else echo "• prep-log.json already exists (skipped)" fi ``` From `scripts/prep.sh`: ```bash echo -e "$BRIEF_CONTENT" > "$FILEPATH" ``` ### Technical Analysis The setup and preparation scripts create directories and files using the caller's ambient `umask`. They do not explicitly enforce: - `0700` permissions on the meeting-prep directory and brief directory. - `0600` permissions on configuration, history, logs, and generated briefs. - Secure permissions for files that already exist. Briefs and logs can contain attendee email addresses, meeting identifiers, company affiliations, schedules, research results, and conversation context. The configuration is also intended to contain calendar and delivery preferences. On systems with a permissive `umask`, these files may become readable by members of the same group or by other local users. The default permissions vary by environment, so exposure depends on host configuration. ### Attack Path 1. The Skill r ...[truncated 1169 chars]
Remediation: View remediation
"$PREP_DIR/brief-history.json" chmod 0600 "$PREP_DIR/brief-history.json" ``` 4. Ensure generated briefs and temporary files are mode `0600`. 5. Audit and repair permissions on existing installations: ```bash chmod 0700 "$PREP_DIR" "$PREP_DIR/briefs" chmod 0600 "$PREP_DIR/config.json" \ "$PREP_DIR/brief-history.json" \ "$PREP_DIR/prep-log.json" find "$PREP_DIR/briefs" -type f -exec chmod 0600 {} + ``` 6. Keep temporary update files in the protected directory and apply restrictive permissions before writing sensitive data. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a full meeting-intelligence agent that researches attendees, gathers external context, generates briefing docs, and can run automatically before meetings. The supplied code chunk only retrieves the path to an existing brief from a local JSON history file or accepts a direct file path, then prints the brief in one of several simple output formats. Its primary purpose is viewing/rendering previously created briefs, not researching people or generating meeting prep. This is a material mismatch in primary functionality and accessed resources.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The cleanup section claims the history reset is only for a mock run, but the code unconditionally deletes and recreates the real history file every execution. In this skill, that is dangerous because the history file tracks already-prepped meetings; erasing it can cause repeated processing, loss of user state, and cascading automated actions against future calendar events.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: An overly broad auto-trigger can cause the skill to run on more meetings or contexts than the user intended, which may lead to unnecessary processing of calendar metadata and attendee information. In a privacy-sensitive workflow, unintended invocation increases the risk of collecting, storing, or surfacing personal and business context without deliberate user review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill handles calendar events, attendee identities, and enrichment from public sources, all of which are privacy-sensitive data categories. Without a prominent upfront warning and consent-oriented explanation, users may enable automation without understanding what personal data is accessed, stored, and potentially redistributed in generated briefs.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script presents the event source as a harmless mock/placeholder, but it still performs a real write to the user's persistent history file with jq -n ... > "$HISTORY_FILE". That creates state changes in a config directory during what appears to be test logic, which is risky because users or automation may run it assuming no persistent side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script overwrites the history file without warning or confirmation, even though this file is part of persistent user state under ~/.config/meeting-prep. Silent replacement of tracking data can undermine integrity of automation, hide prior state, and make later runs behave unpredictably.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Deleting and recreating the history file at the end of every run silently destroys persistent bookkeeping. In the context of a meeting automation skill, this makes the tool forget what it has already processed, increasing the chance of duplicate briefs, repeated external lookups, unnecessary API use, and noisy or privacy-impacting repeated automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script writes generated meeting briefs containing attendee research and company context directly to a persistent file under the user's home configuration directory without any explicit user confirmation, visibility control, or data-minimization safeguards. In this skill's context, the content is likely to include sensitive personal and professional profiling data, so silent local persistence increases the risk of privacy leakage, unintended retention, and later exposure through backups, shared machines, or compromise of the host account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The script automatically invokes another shell script for qualifying events, which can trigger downstream actions based on event data. While there is a log line indicating the prep script is running, there is no explicit warning or confirmation that automated processing of upcoming meetings will occur.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.